minor fixes

cpp/ql/src/experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql

@@ -4,13 +4,11 @@
  *              unauthorized persons.
  * @kind path-problem
  * @problem.severity error
- * @precision high
+ * @id cpp/private-cleartext-write
- * @id cpp/exposure-of-sensitive-information
  * @tags security
  *       external/cwe/cwe-359
  */
 
-
 import cpp
 import experimental.semmle.code.cpp.security.PrivateCleartextWrite
 import experimental.semmle.code.cpp.security.PrivateCleartextWrite::PrivateCleartextWrite

cpp/ql/src/experimental/semmle/code/cpp/security/ExternalLocationSink.qll

@@ -1,14 +0,0 @@
-import cpp
-import semmle.code.cpp.security.BufferWrite
-import semmle.code.cpp.security.FileWrite
-
-/**
- * A write, to either a file or a buffer
- */
-abstract class ExternalLocationSink extends DataFlow::ExprNode { }
-
-class Temp extends ExternalLocationSink {
-  Temp() {
-      none()
-    }
-}

cpp/ql/src/experimental/semmle/code/cpp/security/PrivateCleartextWrite.qll

@@ -6,8 +6,8 @@ import cpp
 import semmle.code.cpp.dataflow.TaintTracking
 import experimental.semmle.code.cpp.security.PrivateData
 import semmle.code.cpp.security.FileWrite
+import semmle.code.cpp.security.BufferWrite
 import semmle.code.cpp.dataflow.TaintTracking
-import experimental.semmle.code.cpp.security.ExternalLocationSink
 
 module PrivateCleartextWrite {
   /**
@@ -60,7 +60,4 @@ module PrivateCleartextWrite {
       )
     }
   }
-  // class ExternalLocation extends Sink {
-  //   ExternalLocation() { this instanceof ExternalLocationSink }
-  // }
 }

cpp/ql/src/experimental/semmle/code/cpp/security/PrivateData.qll

@@ -19,7 +19,7 @@ private string privateNames() {
   // Contact information, such as home addresses and telephone numbers
   result = "%postcode%" or
   result = "%zipcode%" or
-  result = "%telephone%" or
+  // result = "%telephone%" or
   // Geographic location - where the user is (or was)
   result = "%latitude%" or
   result = "%longitude%" or
@@ -28,8 +28,8 @@ private string privateNames() {
   result = "%salary%" or
   result = "%bankaccount%" or
   // Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
-  result = "%email%" or
+  // result = "%email%" or
-  result = "%mobile%" or
+  // result = "%mobile%" or
   result = "%employer%" or
   // Health - medical conditions, insurance status, prescription records
   result = "%medical%"

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.expected

@@ -1,6 +1,6 @@
-| test.cpp:50:9:50:16 | theEmail | This write may contain unencrypted data |
+| test.cpp:50:9:50:18 | theZipcode | This write may contain unencrypted data |
 | test.cpp:66:24:66:30 | medical | This write may contain unencrypted data |
 | test.cpp:70:24:70:27 | temp | This write may contain unencrypted data |
 | test.cpp:74:24:74:28 | buff5 | This write may contain unencrypted data |
-| test.cpp:87:35:87:42 | theEmail | This write may contain unencrypted data |
+| test.cpp:87:37:87:46 | theZipcode | This write may contain unencrypted data |
-| test.cpp:90:40:90:47 | theEmail | This write may contain unencrypted data |
+| test.cpp:90:42:90:51 | theZipcode | This write may contain unencrypted data |

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/test.cpp

@@ -43,14 +43,14 @@ char *func(char *buffer) {
 
 // test for CleartextFileWrite
 void file() {
-  char *theEmail = "cleartext email!";
+  char *theZipcode = "cleartext zipcode!";
   FILE *file;
 
-  // BAD: write email to file in cleartext
+  // BAD: write zipcode to file in cleartext
-  fputs(theEmail, file);
+  fputs(theZipcode, file);
 
   // GOOD: encrypt first
-  char *encrypted = encrypt(theEmail);
+  char *encrypted = encrypt(theZipcode);
   fwrite(encrypted, sizeof(encrypted), 1, file);
 }
 
@@ -80,17 +80,17 @@ int main(int argc, char** argv) {
 
 // test for CleartextFileWrite
 void stream() {
-  char *theEmail = "cleartext email!";
+  char *theZipcode = "cleartext zipcode!";
   ofstream mystream;
 
-  // BAD: write email to file in cleartext
+  // BAD: write zipcode to file in cleartext
-  mystream << "the email is: " << theEmail;
+  mystream << "the zipcode is: " << theZipcode;
 
-  // BAD: write email to file in cleartext
+  // BAD: write zipcode to file in cleartext
-  (mystream << "the email is: ").write(theEmail, strlen(theEmail));
+  (mystream << "the zipcode is: ").write(theZipcode, strlen(theZipcode));
 
   // GOOD: encrypt first
-  char *encrypted = encrypt(theEmail);
+  char *encrypted = encrypt(theZipcode);
-  mystream << "the email is: " << encrypted;
+  mystream << "the zipcode is: " << encrypted;
-  (mystream << "the email is: ").write(encrypted, strlen(encrypted));
+  (mystream << "the zipcode is: ").write(encrypted, strlen(encrypted));
 }